Type to search.

Get rules in bulk

Base URL
https://{kibana_url}
  • POST /api/alerting/v2/rules/_bulk_get
  • POST /s/{space_id}/api/alerting/v2/rules/_bulk_get
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Returns the requested rules. Ids that match no rule are reported per item in errors as RULE_NOT_FOUND. The request itself succeeds as long as it is valid.

Required privileges

Privileges read_alerting-v2-rules

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

ids string[] · min items: 1 · max items: 100 required

Explicit list of IDs to operate on. Each id can appear at most once.

Responses

Returns the rules that were found in items and a per-item error in errors for every id that matched no rule.

application/json
errors object[] required

Errors for rules that could not be returned, keyed by the requested id. A rule that does not exist is reported as RULE_NOT_FOUND. Empty when every requested rule was found.

error object required
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

id string required

The identifier of the resource that failed.

items object[] required

The rules that were found, in the same order as the requested ids. Rules listed in errors are not included.

created_at string · format: date-time · max length: 64 required

ISO timestamp when the rule was created.

created_by object required

Actor who created the rule.

profile_uid string required nullable

User profile ID of the actor, or null when it cannot be resolved.

enabled boolean required

Whether the rule is enabled.

id string required

Unique rule identifier.

kind enum required

Whether the rule creates alerts (alert) or only stores matching events (signal).

Values: alert signal
metadata object required

Rule metadata.

description string · min length: 1 · max length: 1024

Human-readable description of the rule. Omit to leave it unset; send null on PATCH to clear it. An empty string is rejected.

name string · min length: 1 · max length: 256 required

Rule name.

routing_tags string[] · min items: 1 · max items: 20

Routing tags that link alerts from this rule to action policies. An action policy applies when its matcher.tags contains at least one of these tags. Only allowed when kind is "alert".

tags string[] · min items: 1 · max items: 20

Tags for categorization, e.g. ["production", "infra"].

no_data union oneOf

What the rule does when a group has no data. Required when kind is alert. Not allowed when kind is signal. Any strategy other than ignore requires either query.breach or no_data.query, so that a group with no data can be told apart from one that stopped breaching.

One of: (determined by strategy)
strategy: ignore

Does not check whether a group still has data. Missing groups do not produce no_data events.

strategy enum required
Values: ignore
query object required

ES|QL query the rule evaluates. base is required. breach is an optional clause appended to it.

base string · min length: 1 · max length: 10000 required

ES|QL query that specifies the data to evaluate. Must include a FROM clause. Kibana applies the time filter from schedule.lookback using time_field.

recovery union oneOf

When an alert recovers. Required when kind is alert. Not allowed when kind is signal.

One of: (determined by strategy)
strategy: no_breach

Recovers the alert when its group no longer appears in the breach results.

strategy enum required
Values: no_breach
schedule object required

Execution schedule configuration.

every string · max length: 32 required

Execution interval, e.g. 1m, 5m, 1h.

lookback string · max length: 32

Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.

time_field string · min length: 1 · max length: 256 · default: @timestamp

Document field Kibana uses with schedule.lookback to time-filter query.base.

updated_at string · format: date-time · max length: 64 required

ISO timestamp when the rule was last updated.

updated_by object required

Actor who last updated the rule.

profile_uid string required nullable

User profile ID of the actor, or null when it cannot be resolved.

version integer · min: 1 · max: 9007199254740991 required

Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as rule.version.